CVE-2025-64443 DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertiseme...

CVE-2025-64443

The CVE-2025-64443 entry concerns the Docker MCP Gateway. In versions up to 0.27.0, when running in sse or streaming transport mode, it is vulnerable to DNS rebinding, enabling browser-based exploitation of MCP servers behind the gateway if a victim visits a malicious site or ad. The gateway is n...

CVE-2025-64443: Exposed Dangerous Method or Function

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertiseme...

CVE-2025-62593: Improper Control of Generation of Code

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense us...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...

CVE-2025-5770: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling...

EUVD-2025-30813

Malicious code in bioql PyPI...

EUVD-2022-25963

Malicious code in bioql PyPI...

EUVD-2022-53391

Malicious code in bioql PyPI...

EUVD-2022-35445

Malicious code in bioql PyPI...

EUVD-2022-31436

Malicious code in bioql PyPI...

EUVD-2022-34277

Malicious code in bioql PyPI...

CVE-2025-57601

AiKaan Cloud Controller uses a single hardcoded SSH private key and the username proxyuser for remote terminal access to all managed IoT/edge devices. When an administrator initiates "Open Remote Terminal" from the AiKaan dashboard, the controller sends this same static private key to the target...

PT-2025-38730

Name of the Vulnerable Software and Affected Versions AiKaan Cloud Controller affected versions not specified Description The AiKaan Cloud Controller utilizes a single, hardcoded SSH private key and the username proxyuser for remote terminal access to all managed IoT/edge devices. When an...

6 Browser-Based Attacks Security Teams Need to Prepare For Right Now

Attacks that target users in their web browsers have seen an unprecedented rise in recent years. In this article, we’ll explore what a “browser-based attack” is, and why they’re proving to be so effective. What is a browser-based attack? First, it’s important to establish what a browser-based...

6 Browser-Based Attacks Security Teams Need to Prepare For Right Now

Attacks that target users in their web browsers have seen an unprecedented rise in recent years. In this article, we'll explore what a "browser-based attack" is, and why they're proving to be so effective. What is a browser-based attack? First, it's important to establish what a browser-based...

Malware in proto-tinker-wc

Any computer that has this package installed or running should be considered affected by a browser-based interceptor that hijacks network traffic and application APIs. The interceptor injects itself into functions related to web traffic and cryptocurrency wallets. The interceptor replaces values...

Malware in chalk-template

Any computer that has this package installed or running should be considered affected by a browser-based interceptor that hijacks network traffic and application APIs. The interceptor injects itself into functions related to web traffic and cryptocurrency wallets. The interceptor replaces values...

Malware in wrap-ansi

Any computer that has this package installed or running should be considered affected by a browser-based interceptor that hijacks network traffic and application APIs. The interceptor injects itself into functions related to web traffic and cryptocurrency wallets. The interceptor replaces values...

Malware in ansi-regex

Any computer that has this package installed or running should be considered affected by a browser-based interceptor that hijacks network traffic and application APIs. The interceptor injects itself into functions related to web traffic and cryptocurrency wallets. The interceptor replaces values...